+6 -4

src/tamis/client.gleam

View file Reviewed

··· 59 59 req: request.Request(String), 60 60 url: String, 61 61 ) -> Result(#(Int, String), Error) { 62 62 - // TLS verification is on: gleam_httpc verifies `https` peers against the OS CA 63 63 - // store (public_key:cacerts_get), the webpki-roots equivalent. `http://` 64 64 - // targets are reached directly; the http-vs-https policy lives in did.gleam. 65 65 - let config = httpc.configure() |> httpc.verify_tls(True) 62 62 + // Verify TLS for `https` peers against the OS CA store (public_key:cacerts_get). 63 63 + // For `http` targets there is nothing to verify, and forcing verification would 64 64 + // needlessly require the CA store to exist. The http-vs-https policy lives in 65 65 + // did.gleam. 66 66 + let config = 67 67 + httpc.configure() |> httpc.verify_tls(string.starts_with(url, "https")) 66 68 case httpc.dispatch(config, req) { 67 69 Ok(resp) -> Ok(#(resp.status, resp.body)) 68 70 Error(e) -> Error(error.Transport(url, string.inspect(e)))

+2 -1

src/tamis/oauth.gleam

View file Reviewed

··· 9 9 import atproto/oauth/tokens 10 10 import atproto/xrpc 11 11 import atproto_core/xrpc as core_xrpc 12 12 + import gleam/http 12 13 import gleam/httpc 13 14 import gleam/json.{type Json} 14 15 import gleam/option.{type Option, None, Some} ··· 28 29 pub fn client() -> xrpc.Client { 29 30 xrpc.Client(send: fn(req) { 30 31 httpc.configure() 31 31 - |> httpc.verify_tls(True) 32 32 + |> httpc.verify_tls(req.scheme == http.Https) 32 33 |> httpc.dispatch_bits(req) 33 34 |> result.map_error(fn(e) { core_xrpc.Other(string.inspect(e)) }) 34 35 })